More about Netscape Bug finder
--- begin forwarded text Date: Mon, 16 Jun 1997 18:24:32 -0500 From: Bill GL Stafford <springco@arn.net> Organization: Spring Management Company MIME-Version: 1.0 To: "dcsb@ai.mit.edu" <dcsb@ai.mit.edu> Subject: More about Netscape Bug finder X-Priority: 3 (Normal) Sender: bounce-dcsb@ai.mit.edu Precedence: bulk Reply-To: Bill GL Stafford <springco@arn.net> Christian Orellana, gambled $1000 and lost. Not the worst thing he could have done. Now the world knows how Netscape approaches a potential crisis. They did not panic although they may have come close to it. I've seen that much lost in a cloak room with a pot not near as big as Christian sought. Anyway you look at it it's just a roll of the dice.Bill GL Stafford springco@arn.net Wired Magazine on web An Email Trail from Bug Spotter to Netscape 6:01pm 13.Jun.97.PDT The following is a copy of the email exchange between Netscape officials and Christian Orellana, the Danish consultant who found the Netscape Navigator bug. A copy of the text was provided to Wired News by Netscape and appears unedited. Wired News has chosen not to publish Orellana's email address. Subject: Major security bug in Netscape Navigator 3 and 4 Date: Mon, 9 Jun 1997 19:19:13 +0200 From: Christian Orellana To: stracy@netscape.com Hello! We have discovered a major security bug in Netscape Navigator 3.0, which remains uncorrected in the new Communicator release. The bug affects Navigator running on all platforms in the standard configuration. The bug allows access to any file on the clients file system, and does not affect Microsoft Internet Explorer. This bug is potentially very interesting to Netscape considering that the new release of Navigator is due in just three days. The bug has not previously been reported, and remains unknown to anyone but us (to the best of our knowledge). Please get back to us a.s.a.p. (before Netscape DevCon) if this knowledge is of any interest to you. You can reach me at the phone number below. I have tried to reach Netscape for a while now, and if Netscape remains uninterested in the issue I may contact some other interested parties. Yours sincerely, Christian Orellans [sic] --- Subject: Please confirm Date: Mon, 9 Jun 1997 20:14:08 +0200 From: Christian Orellana To: stracy@netscape.com Hello! Could you please confirm that you have received my previous letter. Also I would like to restate my claim that this is of the utmost importance for the upcoming launch of Communicator. The bug allows complete read access to the clients hard disk. Christian Orellana. --- Subject: Re: [Fwd: Major security bug in Netscape Navigator 3 and 4] Date: Mon, 09 Jun 1997 11:51:04 -0700 From: edithg@netscape.com (Edith Gong) Organization: Netscape Communications To: Shannon Tracy , lalam@netscape.com References: <339C3C32.FE3F5683@netscape.com> Shannon, I don't know what else to do. Can someone in DSE contact this person to get the details by phone. We can't investigate until we understand what the issue is. I'll see if someone in tech support can contact the customer Edith --- Subject: Re: Please confirm Date: Mon, 09 Jun 1997 12:00:03 -0700 From: Shannon Tracy Organization: Netscape Communications To: Christian Orellana References: Dear Christian Orellana: Yes, I received your message. The project manager just responded that they are trying to find someone to contact you, however, we can't investigate until we understand what the issue is. Can you please furnish a few additional details so that we know who best might be able to handle this situation? Thanks, Shannon Tracy --- Subject: Re: Please confirm Date: Mon, 9 Jun 1997 21:11:44 +0200 From: Christian Orellana To: stracy@netscape.com (Shannon Tracy) References: Dear Shannon. In short the first version of the bug I had up and running allowed me to get any file whose path I knew on the clients hard disk. I just got another version up and running, and considering that the location of quite a few files on a typical windows/mac/unix installation is pretty well known, it should be no surprise that this new version can actually scan the clients harddisk for specific files, and download them. I can not reveal much more detail, without giving away the bug, which I will not do, since I think this information is so valuable to Netscape that it should be worth a good deal of money. The information is certainly worth a bit on the free market, and I am currently awaiting responses from other parties. In other words I think the person most suited for handling this, is someone in charge of the company check book (-; Regards - Christian --- Subject: final note on Navigator bug Date: Mon, 9 Jun 1997 23:07:59 +0200 From: Christian Orellana To: stracy@netscape.com (Shannon Tracy) Netscape: I think my approach to you on this subject has been fair and serious. I am offering you a piece of information that I consider of very high value. The implications of the bug mentioned in previous emails are immense. Considering the widespread use of home-banking software, not to mention the impact on multiuser systems in the government and corporate sector, like unix and NT environments, where access to the encrypted password-files would render the systems extremely vulnerable, I think all pre Communicator versions of Navigator (supposing you fix the bug in Communicator) would be pretty useless. I will leave it to you to estimate what impact that would have on Netscape stocks. I have to inform you that David Gross at CNN is on hold with the news, and is only waiting for me to give him the final demonstration, to verify the bug. I must also inform you that CNN is not the only interested party, and that I will consider my options once I get Netscape's standpoint on the matter. I would be more than happy to give a demonstration of the bug, under controlled circumstances, but we would have to sign some sort of agreement first. Regards, Christian Orellana. --- Subject: Re: [Fwd: Major security bug in Netscape Navigator 3 and 4] Date: Thu, 12 Jun 1997 16:40:33 -0700 From:chrish@netscape.com (Chris Holten) Organization: Netscape Communications To:chrish@netscape.com References: 1 Subject: Major security bug in Netscape Navigator 3 and 4 Date: Mon, 9 Jun 1997 19:19:13 +0200 From: Christian Orellana To: stracy@netscape.com Hello! We have discovered a major security bug in Netscape Navigator 3.0, which remains uncorrected in the new Communicator release. The bug affects Navigator running on all platforms in the standard configuration. The bug allows access to any file on the clients file system, and does not affect Microsoft Internet Explorer. This bug is potentially very interesting to Netscape considering that the new release of Navigator is due in just three days. The bug has not previously been reported, and remains unknown to anyone but us (to the best of our knowledge). Please get back to us a.s.a.p. (before Netscape DevCon) if this knowledge is of any interest to you. You can reach me at the phone number below. I have tried to reach Netscape for a while now, and if Netscape remains uninterested in the issue I may contact some other interested parties. Yours sincerely, Christian Orellans --- Subject: Please confirm Date: Mon, 9 Jun 1997 20:14:08 +0200 From: Christian Orellana To: stracy@netscape.com Hello! Could you please confirm that you have received my previous letter. Also I would like to restate my claim that this is of the utmost importance for the upcoming launch of Communicator. The bug allows complete read access to the clients hard disk. Christian Orellana. For help on using this list (especially unsubscribing), send a message to "dcsb-request@ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah@shipwright.com), Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/
A few comments... Almost every non-trivial program which runs on a platform which does not shield the OS from applications can be subverted to give access to the target machine. This is hardly news. The fact that a determined Dane with a debugger managed to poke through the code and break something is neither earth-shattering nor remarkable. In something the size of Netscape, I'm sure 999,999 exploits still remain. The company is hardly going to start writing checks every time someone finds one of them. Until all application software runs on secure virtual machines, or passes bytecode verification and formal proofs of correctness, this problem will continue to exist, not only in Netscape, but in every other large application as well. Big Yawn. -- Mike Duvos $ PGP 2.6 Public Key available $ enoch@zipcon.net $ via Finger. $
On Mon, 16 Jun 1997 22:41:24 -0400, you wrote:
An Email Trail from Bug Spotter to Netscape 6:01pm 13.Jun.97.PDT The following is a copy of the email exchange between Netscape officials and
[rest snipped] Notice that none of this exchange is signed in any way. I don't doubt Netscape's claim as to what happened, but really this is just a bunch of letters assembled in the right order. There's no reason to trust the contents. Brian ---------------------------------------------------------------------------------- Brian C. Lane http://www.eskimo.com/~nexus KC7TYU ----------- 1024/57B17CA9 96B9 C123 5C90 BECC 6A1F 7DC6 4F2B A26E -------------
At 03:32 PM 6/28/97 GMT, Brian Lane wrote:
On Mon, 16 Jun 1997 22:41:24 -0400, you wrote:
An Email Trail from Bug Spotter to Netscape 6:01pm 13.Jun.97.PDT The following is a copy of the email exchange between Netscape officials and
[rest snipped]
Notice that none of this exchange is signed in any way. I don't doubt Netscape's claim as to what happened, but really this is just a bunch of letters assembled in the right order. There's no reason to trust the contents.
This reminded me to ask if anyone knows if, per their statement, Netscape intends to u/l a patch for the 3.x versions. When I checked yesterday, I didn't see any reference to it. ********************************************************* Lynne L. Harrison, Esq. | "The key to life: Poughkeepsie, New York | - Get up; lharrison@mhv.net | - Survive; http://www.dueprocess.com | - Go to bed." ************************************************************ DISCLAIMER: I am not your attorney; you are not my client. Accordingly, the above is *NOT* legal advice.
Lynne L. Harrison wrote:
At 03:32 PM 6/28/97 GMT, Brian Lane wrote:
On Mon, 16 Jun 1997 22:41:24 -0400, you wrote:
An Email Trail from Bug Spotter to Netscape 6:01pm 13.Jun.97.PDT The following is a copy of the email exchange between Netscape officials and
[rest snipped]
Notice that none of this exchange is signed in any way. I don't doubt Netscape's claim as to what happened, but really this is just a bunch of letters assembled in the right order. There's no reason to trust the contents.
This reminded me to ask if anyone knows if, per their statement, Netscape intends to u/l a patch for the 3.x versions. When I checked yesterday, I didn't see any reference to it.
Yes, we're working on a patch for 3.x. It's somewhat harder to do than patching 4.0 because we weren't set up to build 3.x anymore. For some of the weirder Unix platforms we had to reinstall older versions of compilers and OSes. -- What is appropriate for the master is not appropriate| Tom Weinstein for the novice. You must understand Tao before | tomw@netscape.com transcending structure. -- The Tao of Programming |
participants (5)
-
Lynne L. Harrison -
Mike Duvos -
nexus＠eskimo.com -
Robert Hettinga -
Tom Weinstein